What are dynamic external objects/groups and how can we configure it?

05/07/2020 16 4323

DESCRIPTION:

A Dynamic External Address Group is an Address Group whose members are dynamic. Dynamic External Address Objects are intermediate, internal objects that are dynamically created and placed under a Dynamic External Address Group when a Dynamic External Address Group file is downloaded. The Dynamic External Objects feature eliminates the need for manually modifying an Address Group to add or remove members.

RESOLUTION:

Dynamic External Objects Page:

Multiple Dynamic External Address Groups can be configured, and you can use these DEAGs in access rules or policies. For example, if you want to maintain a group for all partner IP addresses on which certain access rules are enforced, you can create a Dynamic External Address Group / Dynamic External Object.

• Navigate to Manage | Objects | Dynamic External Objects to look at the configured objects.
• Under Comments, a green circle indicates that the DEAG file was successfully downloaded, while a red circle indicates an error.

Dynamic External Address Group File:

The Dynamic External Address Group file (DEAG file) contains a list of IP addresses or Fully Qualified Domain Names (FQDNs) that define the DEAOs which are members of the DEAG. The DEAG file resides externally, on a server for FTP access or on a web page at a specific URL for HTTPS access. The list of IP addresses or FQDNs can be modified at the external location and the associated DEAOs and DEAG in SonicOS are dynamically updated with those changes, if configured to periodically download the file. The DEAG file can contain a text list of either IP addresses or FQDNs formatted as follows:

• A list of IP addresses, one per line. It can include subnets specified in CIDR format.
• A list of FQDNs, one per line. An FQDN is a character string such as www.example.com. It cannot contain any wildcard (*) characters.
• A mixed list of FQDNs and IP addresses/subnets, one per line.

This is only supported for FQDN type DEAGs. A non-FQDN type DEAG will not accept FQDNs in the DEAG file. However, it is not recommended to mix and match IP addresses and FQDNs in the DEAG file, because the IP addresses in this list will also be treated as FQDNs and SonicOS will attempt to resolve them. A better way to mix these input types is to create individual DEAGs of FQDN type and non-FQDN type and then add both DEAGs to a separate address group for use in access rules. For every DEAG, a DEAO with the IP address 0.0.0.0 is automatically created. For example, if there is only one DEAG, the maximum number of IP addresses in the DEAG file is one less than the maximum number of DEAOs allowed, as defined in DEAG and DEAO Maximums.

DEAG and DEAO Maximums:

Maximum DEAGs:

• The maximum number of DEAGs, including both IP address and FQDN types, is 25% of the total number of address groups supported by the device.
• The maximum number of DEAGs that can be created cannot exceed the number of address groups remaining before exceeding the total number supported on the firewall. For example, if a device supports 1024 Address Groups and you are using only 20 Address Groups, then 256 DEAGs (25% of 1024) can be created. However, if you have already manually created 1000 Address Groups, then only 24 DEAGs can be created.

Maximum DEAOs:

• The maximum number of IP address type DEAOs is 25% of the total number of address objects supported by the device.
• The maximum number of FQDN type DEAOs is 50% of the total number of address objects supported by the device.
• The maximum number of DEAOs that can be created cannot exceed the number of address objects remaining before exceeding the total number supported on the firewall.
  
  

  To add a Dynamic External Object:

  1. Navigate to the MANAGE | Policies | Objects > Dynamic External Objects page.
  2. Click the Add button. The Add Dynamic External Objects dialog displays.
     
  3. The Type field is set to Address Group, with no other options.
  4. Enter a unique, descriptive name for the dynamic external address group in the Name field. “DEAG_” is automatically prepended to the name when saved.
  5. In the Zone Assignment drop-down list, select the zone for the Dynamic External Address Group.
  6. If you are using FQDNs for this DEAG, select the FQDN checkbox.
  7. Select the Enable Periodic Download checkbox for ongoing, periodic downloads of the Dynamic Address Group File.
  8. If Enable Periodic Download is enabled, select the number of minutes or hours between downloads in the Download interval field. You can select one of:
     
     a) 5 minutes
     b) 15 minutes
     c) 1 hour
     d) 24 hours
     
     
  9. Select the type of protocol to use for downloading the DEAG file from the Protocol drop-down list. The choices are FTP or HTTPS. The remaining fields in the dialog are different for FTP and HTTPS.
  10. If you selected FTP as the protocol, specify the following:
      
      a) Server IP Address – the IP address of the FTP server where the DEAG file resides
      b) Login ID – the user name for logging into the FTP server 
      c) Password – the password for logging into the FTP server
      d) Directory Path – the folder in which the DEAG file resides on the FTP server 
      e) File Name – the name of the DEAG file on the FTP server
      
      
  11. If you selected HTTPS as the protocol, specify the following:
      URL Name – the URL which has the list of IP addresses or FQDNs
      
      The URL Name should start with https:// and follow with the page name. This page contains the list of IP addresses or FQDNs.
  12. Click OK.
      
      Based on the configuration, the firewall reads the list of IP addresses or FQDNs from the file or URL. Then SonicOS automatically creates the following:
      
      a) Address group with the name provided in the Add Dynamic External Object dialog. This address group is read-only, meaning that you cannot edit or delete it.
      b) Address objects for every valid unique IP address or FQDN in the file. These address objects are also read-only.
      
      The individual address objects are then added to the Dynamic External Address Group / Dynamic External Object. You can use this in access rules and policies.
      
      

      NOTE:  We cannot change the Name of the DEAG or the Zone Assignment when editing the Dynamic External Object. Also, if a Dynamic External Address Group is in use, such as when an access rule is using it, the deletion attempt will fail.